地图 / CVE-2017-5969: libxml2 when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference)

CVE-2017-5969: libxml2 when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference)

内存破坏 / 空指针解引用 / #262665

厂商: Internet Bug Bounty
严重程度: 低危
赏金: —
弱点: 空指针解引用
研究员: @geeknik
披露日期: 2019-10-04
资产: IBB (Legacy)
CVE: CVE-2017-5969

该报告还没有中文解读。

原文摘录

摘自原文（9764 字符中的一小部分）

I first reported this bug to the developers on [20 November 2015](https://bugzilla.gnome.org/show_bug.cgi?id=758422). A patch was finally committed on 7 June 2017 [here](https://git.gnome.org/browse/libxml2/commit/?id=94691dc884d1a8ada39f073408b4bb92fe7fe882). The caveat here is that this only …

原文中的代码

test00.xml:1: parser error : xmlParseDocTypeDecl : no DOCTYPE name !
<!DOCTYPE[<?l?><!ELEMENT�(�,()>
         ^
test00.xml:1: parser error : Space required after 'ELEMENT'
<!DOCTYPE[<?l?><!ELEMENT�(�,()>
                        ^
test00.xml:1: parser error : Input is not proper UTF-8, indicate …

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

2017-08-23报告提交
2019-10-04公开披露

阅读 HackerOne 原文 ↗作者 @geeknik · 版权归作者与 Internet Bug Bounty 所有

同类报告

Null Pointer Dereference by Crafted Response from AI ModelBrave Software · 2025-03-26 Null pointer dereference in SMTP server function smtp_string_parseOpen-Xchange · — · $1,500 NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changesetNode.js · 2026-05-23 wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof)Monero · 2026-08-05 Crash in mrb_ary_pushshopify-scripts · 2019-09-04 · $800 important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)Internet Bug Bounty · 2024-07-13 · $4,920

CVE-2017-5969: libxml2 when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) · 破甲 POJIA